7.8

CVE-2020-10610

In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Osisoft ≫ Pi Api Version <= 1.6.8.26
Osisoft ≫ Pi Api SwPlatformwindows_integrated_security Version <= 2.0.2.5
Osisoft ≫ Pi Buffer Subsystem Version <= 4.8.0.18
Osisoft ≫ Pi Connector SwPlatformping Version <= 1.0.0.54
Osisoft ≫ Pi Connector SwPlatformethernet/ip Version <= 1.1.0.10
Osisoft ≫ Pi Connector SwPlatformbacnet Version <= 1.2.0.6
Osisoft ≫ Pi Connector SwPlatformdc_systems_rtscada Version <= 1.2.0.42
Osisoft ≫ Pi Connector SwPlatformsiemens_simatic_pcs_7 Version <= 1.2.1.71
Osisoft ≫ Pi Connector SwPlatformiec_60870-5-104 Version <= 1.2.2.79
Osisoft ≫ Pi Connector SwPlatformhart-ip Version <= 1.3.0.1
Osisoft ≫ Pi Connector SwPlatformopc-ua Version <= 1.3.0.130
Osisoft ≫ Pi Connector SwPlatformufl Version <= 1.3.1.135
Osisoft ≫ Pi Connector SwPlatformcygnet Version <= 1.4.0.17
Osisoft ≫ Pi Connector SwPlatformwonderware_historian Version <= 1.5.0.88
Osisoft ≫ Pi Connector Relay Version <= 2.5.19.0
Osisoft ≫ Pi Data Archive Version <= 3.4.430.460
Osisoft ≫ Pi Data Collection Manager Version <= 2.5.19.0
Osisoft ≫ Pi Integrator SwPlatformbusiness_analytics Version <= 2.2.0.183
Osisoft ≫ Pi To Ocs Version <= 1.1.36.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.296
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02
Third Party Advisory
US Government Resource